DHS FINANCIAL 

MANAGEMENT

Continued Effort Needed to 

Address Internal Control 

and System Challenges

Statement of Asif A. Khan, Director

Financial Management and Assurance

Testimony 

Before the Subcommittee on Oversight 

and Management Efficiency,

Committee on Homeland Security,

House of Representatives

For Release on Delivery 

Expected at 9:30 a.m., EST

Friday, November 15, 2013

GAO-14-106T

United States Government Accountability Office
Page 1 GAO-14-106T 

Chairman Duncan, Ranking Member Barber, and Members of the 

Subcommittee:

I am pleased to be here today to discuss our recent work on the 

Department of Homeland Security’s (DHS) efforts to improve its financial 

management and reporting. Since DHS’s inception in March 2003,1

internal control and financial management system weaknesses have 

impeded its ability to provide reliable, timely, and useful financial data to 

support daily operational decision making.2 Those internal control and 

financial management system deficiencies contributed to our decision to 

designate DHS’s management functions—including financial 

management—as high risk in 2003.3 As noted in our 2013 high-risk 

report, continued improvement is needed to mitigate the risks identified 

and to help ensure that management weaknesses do not hinder the 

department’s ability to efficiently and effectively use its resources and 

accomplish its mission.4

The DHS Audit Requirement Target Act of 2012 requires DHS to take the 

necessary steps to ensure that its fiscal year 2013 financial statements 

are ready in a timely manner in order to obtain a clean opinion.5

 1

In March 2003, DHS was created by merging 22 disparate agencies and organizations, 

many of which had known financial management weaknesses and vulnerabilities. Only 5 

of the agencies that transferred to DHS had been subject to financial statement audits—

U.S. Customs Service, Transportation Security Administration, Immigration and 

Naturalization Service, Federal Emergency Management Agency, and Federal Law 

Enforcement Training Center. DHS currently comprises 16 component entities.

A clean 

opinion means that the financial statements are presented fairly, in all 

material respects, in accordance with the applicable accounting 

principles. DHS’s financial statements consist of the consolidated balance 

sheets; statements of net cost, changes in net position, budgetary 

2

Internal control is a major part of managing an organization and comprises the plans, 

methods, and procedures used to meet missions, goals, and objectives and, in doing so, 

supports performance-based management. GAO, Standards for Internal Control in the 

Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999),

provides an overall framework for establishing and maintaining internal control and for 

identifying and addressing major performance and management challenges and areas at 

greatest risk of fraud, waste and abuse, and mismanagement.

3

GAO, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.: January 2003).

4

GAO, High-Risk Series: An Update, GAO-13-283 (Washington, D.C.: February 2013).

5

Pub. L. No. 112-217, § 2(b), 126 Stat. 1591 (Dec. 20, 2012).
Page 2 GAO-14-106T 

resources, and custodial activity; and related notes. Further, DHS is 

required, by the DHS Financial Accountability Act of 2004,

6 to obtain an 

audit opinion on its internal control over financial reporting.7

We have long held that accountability is part of the organizational culture 

that goes well beyond receiving a clean audit opinion on the financial 

statements; the underlying premise is that agencies must become more 

results oriented, cost conscious, and focused on internal control. A 

disciplined and structured approach to assessing internal control is critical 

to successfully implement and maintain adequate financial management 

oversight in the federal government.

A clean 

opinion states that in the auditors’ opinion, the entity maintained effective 

internal control over financial reporting.

My remarks today are primarily based on our September 2013 report on 

DHS financial management issues.8

 6

Pub. L. No. 108-330, § 4(a), 118 Stat. 1275 (Oct. 16, 2004).

Accordingly, this testimony 

addresses DHS’s progress toward (1) obtaining a clean opinion on its 

financial statements; (2) obtaining a clean opinion on its internal control 

over financial reporting; and (3) modernizing its financial systems, 

including the extent to which DHS’s approach for modernizing its current 

financial systems was consistent with Office of Management and Budget 

(OMB) requirements. I will also discuss whether DHS followed certain 

information technology (IT) best practices while implementing its 

approach. For our report, we reviewed relevant DHS guidance and 

documents, determined whether DHS followed OMB requirements and 

certain industry best practices, and interviewed key DHS officials. We 

updated this statement for new information obtained from DHS since the 

issuance of our report related to DHS’s schedule for completing its 

financial system modernization efforts. This work was performed in 

7

The objectives of internal control over financial reporting are to provide reasonable 

assurance that (1) transactions are properly recorded, processed, and summarized to 

permit the preparation of the financial statements in conformity with U.S. generally 

accepted accounting principles, and assets are safeguarded against loss from 

unauthorized acquisition, use, or disposition, and (2) transactions are executed in 

accordance with laws governing the use of budget authority and with other laws and 

regulations that could have a direct and material effect on the financial statements.

8

GAO, DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in 

Internal Controls and Financial Management Systems, GAO-13-561 (Washington, D.C.: 

Sept. 30, 2013).
Page 3 GAO-14-106T 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. Our report 

provides further details on our scope and methodology.

In summary, we found that DHS

• has made considerable progress toward generating reliable financial 

data to obtain a clean opinion on its financial statements,

• has made limited progress in establishing effective controls to obtain a 

clean opinion on its internal control over financial reporting, and

• is in the early planning stages of implementing its decentralized 

approach for modernizing its components’ financial systems, with 

each component determining the specific solution for its financial 

systems modernization.

DHS’s progress on obtaining a clean opinion on its financial statements 

includes reducing the number of audit qualifications from 11 in 2005 to 1 

in 2010;9 receiving a qualified audit opinion10 on two of its five fiscal year 

2011 financial statements—the consolidated balance sheet and 

statement of custodial activity;11

DHS is working to resolve the deficiencies in the U.S. Coast Guard’s 

(USCG)—one of DHS’s major component entities—ability to complete 

expanding the financial audit in fiscal 

year 2012 to all financial statements; and obtaining a qualified opinion on 

the fiscal year 2012 financial statements. DHS was able to achieve this 

progress based in part on management’s commitment to improving its 

financial management process.

 9

An audit qualification is a matter identified by auditors that contributes to their inability to 

render a clean opinion on the financial statements.

10A qualified opinion, in relation to the financial statements, states that certain reported 

balances are unauditable, the financial statements contain a material departure from 

generally accepted accounting principles, or both.

11Auditors reported that (1) the other three financial statements—the statements of net 

cost, changes in net position, and budgetary resources—were not auditable and (2) DHS 

must be able to represent that its balance sheet is fairly stated and to obtain at least a 

qualified opinion before it is practical to extend the audit to other financial statements.

Opinion on Financial 

Statements
Page 4 GAO-14-106T 

certain reconciliations and provide evidence supporting certain 

components of general property, plant, and equipment (PP&E), as well as 

heritage and stewardship assets that caused DHS’s auditors to issue a 

qualified opinion on its fiscal year 2012 financial statements. DHS has a 

goal of achieving a clean opinion for fiscal year 2013. However, the 

auditors’ report indicates that DHS continues to rely on compensating 

controls and complex manual work-arounds to support its financial 

reporting, rather than sound internal control over financial reporting and 

effective financial management systems.

In regard to DHS’s progress on obtaining a clean opinion on internal 

control over financial reporting, from fiscal years 2005 through 2011, 

DHS’s auditors reported a reduction in the number of material 

weaknesses in internal control over financial reporting from 10 to 5 and a 

decrease in the number of control deficiencies contributing to the material 

weaknesses from 30 to 15.12 Although the number of auditor-reported 

material weaknesses in DHS’s internal control over financial reporting has 

decreased since fiscal year 2005, the largest reduction—for fiscal year 

2007—was due to a consolidation of weaknesses into fewer, broader 

categories for reporting purposes.13

 12A material weakness is a significant deficiency, or a combination of significant 

deficiencies, in internal control such that there is a reasonable possibility that a material 

misstatement of the entity’s financial statements will not be prevented, or detected and 

corrected, on a timely basis. A significant deficiency is a control deficiency, or combination 

of deficiencies, in internal control important enough to merit attention by those charged 

with governance. A control deficiency exists when the design or operation of a control 

does not allow management or employees, in the normal course of performing their 

assigned functions, to prevent, or detect and correct, misstatements on a timely basis.

For fiscal year 2012, the most 

recently completed audit, DHS’s auditors reported material weaknesses 

in five areas related to deficiencies at eight components, including USCG.

13For fiscal year 2007, auditors consolidated certain material weaknesses by combining 

(1) intragovernmental balances into the financial reporting material weakness, (2) PP&E 

with the operating materials and supplies material weakness and reporting the 

combination as capital assets and supplies, and (3) actuarial liabilities with the legal and 

other liabilities and reporting the combination as actuarial and other liabilities. The auditors 

noted that DHS had made progress during fiscal year 2007 in remediating the deficiency 

related to intragovernmental balances. USCG was the only DHS component that 

contributed to the fiscal year 2006 material weaknesses in operating materials and 

supplies and actuarial liabilities, but the auditors did not report that USCG had made 

progress during fiscal year 2007 in remediating the deficiencies within operating materials 

and supplies and actuarial liabilities.

Opinion on Internal 

Control
Page 5 GAO-14-106T 

The material weaknesses reported in fiscal year 2012 include (1) financial 

reporting, (2) IT controls and financial system functionality, (3) PP&E, 

(4) environmental and other liabilities, and (5) budgetary accounting.14

According to DHS’s auditors, the existence of these material weaknesses 

limits DHS’s ability to process, store, and report financial data in a 

manner that ensures accuracy, confidentiality, integrity, and availability of 

data without substantial manual intervention. DHS has plans to resolve 

the remaining five material internal control weaknesses, with a goal of 

achieving a clean opinion on internal control over financial reporting for 

fiscal year 2016. DHS will continue to face challenges in obtaining and 

sustaining a clean opinion on its financial statements and attaining a 

clean opinion on its internal control over financial reporting until serious 

internal control and financial management systems deficiencies are 

resolved.

For nearly a decade, DHS tried to modernize its financial management 

systems by attempting to implement a department-wide integrated 

financial management system. DHS’s efforts included two projects—one 

that ended in December 2005 when DHS acknowledged that its pilot 

project had not been successful, and another in June 2011 when 

requirements had changed and DHS canceled the program. Now, under 

its decentralized approach, DHS plans to modernize the financial systems 

of components with the most critical need first and integrate the financial 

systems with asset management and acquisition systems, resulting in 

component-level integrated financial management systems. DHS 

determined that components with a critical business need to modernize 

their financial management systems include Immigration and Customs 

Enforcement and USCG, and their customer components, as well as the 

Federal Emergency Management Agency. Components are in the early 

planning stages of implementing the approach, and as of September 

2013, DHS estimated that its financial system modernization efforts will 

not be completed until fiscal year 2018.

In our September 2013 report, we found that DHS’s decentralized 

approach for modernizing its components’ financial systems is consistent 

with relevant OMB requirements, such as implementing projects in 

smaller, simpler segments, but not all relevant IT best practices have 

 14For detailed information on the five material weaknesses, see GAO-13-561, app. IV.

Financial 

Management Systems
Page 6 GAO-14-106T 

been fully implemented. DHS has implemented certain IT recommended 

best practices that reflect key areas of effective program management, 

such as conducting an analysis of alternatives, establishing a governance 

structure, developing financial management systems baseline business 

process requirements, and developing a description of its current financial 

management environment. However, DHS had not fully incorporated 

other IT best practices, including developing a description of how its 

components’ financial management systems will operate in the future—

called a detailed target state—or a description of how components will 

transition to a new financial management environment—called a 

department-level transition plan.15

To help DHS deploy component-level integrated financial management 

systems, we made two recommendations to DHS regarding the need to 

follow best practices related to its target state and transition plan. After 

reviewing the draft report, DHS generally agreed with our 

recommendations and described actions already taken to address them. 

However, we believe that further action is needed to address these 

recommendations. Specifically, DHS has not developed other important 

details for its target state, such as department-level operational needs 

and characteristics, including the systems’ availability, data flow, 

expandability, and interoperability. In addition, its transition strategy is 

missing needed elements of a transition plan, such as milestones and 

time frames for implementing new systems as well as the optimal 

sequencing of activities. Without a detailed target state and departmentlevel transition plan, DHS has an increased risk of, among other things, 

investing in and implementing systems that do not provide the desired 

capabilities and inefficiently using resources during its financial 

management system modernization efforts.

With regard to the status of DHS’s efforts to complete actions necessary 

to achieve removal from our high-risk list, in a September 2010 letter to 

DHS, we identified, and DHS subsequently agreed to achieve, 31 actions 

and outcomes, including 9 related to financial management, that are 

 15We also had two other findings and recommendations in our report related to IT best 

practices and the need for DHS, at the time of our review, to update its standard operating 

procedures and include specific procedures for (1) revising milestone dates and providing 

written confirmation of completed activities reflected in its integrated master schedule and 

(2) performing key elements of a lessons learned process. After DHS received our draft 

report for comment, DHS finalized its procedures to resolve these issues, and we agreed 

that DHS had completed actions to address these two recommendations.
Page 7 GAO-14-106T 

critical to addressing the high-risk issues and challenges within the 

department’s management areas.16 Based on our recent review, we 

determined that DHS has made progress improving its financial 

management and fully addressing two of the nine high-risk financial 

management actions and outcomes—obtaining top management 

commitment and developing corrective action plans.17 However, a 

significant amount of work remains to be completed on the remaining 

seven financial management actions and outcomes, which include 

obtaining and sustaining a clean opinion on its financial statements, 

addressing weaknesses in internal controls and systems to obtain an 

opinion on the effectiveness of internal control over financial reporting, 

ensuring that its financial systems substantially comply with the Federal 

Financial Management Improvement Act of 1996,18

Chairman Duncan, Ranking Member Barber, and Members of the 

Subcommittee, this concludes my prepared remarks. I would be happy to 

answer any questions that you may have.

and deploying 

modern financial systems at certain components. Achieving these 

outcomes will greatly enhance DHS’s ability to produce reliable, timely, 

and useful financial information to support operational decision making, 

and thus assist it in efficiently and effectively using its resources to 

accomplish its mission.

For future contacts regarding this statement, please contact Asif Khan at 

(202) 512-9869 or at khana@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this statement. Michael LaForge (Assistant Director), Laura Pacheco,

and Leonardo Zapata made key contributions to this statement.

 16For a list and discussion of the 31 actions and outcomes, see GAO, Department of 

Homeland Security: Continued Progress Made Improving and Integrating Management 

Areas, but More Work Remains, GAO-12-1041T (Washington, D.C.: Sept. 20, 2012), and 

High-Risk Series: Government-wide 2013 Update and Progress Made by the Department 

of Homeland Security, GAO-13-444T (Washington, D.C.: Mar. 21, 2013).

17For detailed information on the nine financial management actions and outcomes, see 

GAO-13-561, app. II.

18Pub. L. No. 104-208, div. A, title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996).

GAO Contact and 

Staff 

Acknowledgments

(197130)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.